feat(cloudfront): add denyList to OriginRequestPolicy behaviors

packages/aws-cdk-lib/aws-cloudfront/lib/origin-request-policy.ts

@@ -138,6 +138,14 @@ export class OriginRequestCookieBehavior {
   /** All cookies in viewer requests are included in requests that CloudFront sends to the origin. */
   public static all() { return new OriginRequestCookieBehavior('all'); }
 
+  /** All cookies except the provided `cookies` are included in requests that CloudFront sends to the origin. */
+  public static denyList(...cookies: string[]) {
+    if (cookies.length === 0) {
+      throw new Error('At least one cookie to deny must be provided');
+    }
+    return new OriginRequestCookieBehavior('allExcept', cookies);
+  }
+
   /** Only the provided `cookies` are included in requests that CloudFront sends to the origin. */
   public static allowList(...cookies: string[]) {
     if (cookies.length === 0) {
@@ -194,6 +202,14 @@ export class OriginRequestHeaderBehavior {
     return new OriginRequestHeaderBehavior('whitelist', headers);
   }
 
+  /** All headers except the provided `headers` are included in requests that CloudFront sends to the origin. */
+  public static denyList(...headers: string[]) {
+    if (headers.length === 0) {
+      throw new Error('At least one header to deny must be provided');
+    }
+    return new OriginRequestHeaderBehavior('allExcept', headers);
+  }
+
   /** The behavior of headers: allow all, none or an allow list. */
   public readonly behavior: string;
   /** The headers for the allow list or the included CloudFront headers, if applicable. */
@@ -227,6 +243,14 @@ export class OriginRequestQueryStringBehavior {
     return new OriginRequestQueryStringBehavior('whitelist', queryStrings);
   }
 
+  /** All query strings except the provided `queryStrings` are included in requests that CloudFront sends to the origin. */
+  public static denyList(...queryStrings: string[]) {
+    if (queryStrings.length === 0) {
+      throw new Error('At least one query string to deny must be provided');
+    }
+    return new OriginRequestQueryStringBehavior('allExcept', queryStrings);
+  }
+
   /** The behavior of query strings -- allow all, none, or only an allow list. */
   public readonly behavior: string;
   /** The query strings to allow, if the behavior is an allow list. */

packages/aws-cdk-lib/aws-cloudfront/test/origin-request-policy.test.ts

@@ -141,6 +141,17 @@ describe.each([
   test('allowList() throws if list is empty', () => {
     expect(() => clazz.allowList()).toThrow(new RegExp(`At least one ${type} to allow must be provided`));
   });
+
+  test('denyList()', () => {
+    const behavior = clazz.denyList('SESSION_ID', 'secrets');
+
+    expect(behavior.behavior).toEqual('allExcept');
+    expect(items(behavior)).toEqual(['SESSION_ID', 'secrets']);
+  });
+
+  test('denyList() throws if list is empty', () => {
+    expect(() => clazz.denyList()).toThrow(new RegExp(`At least one ${type} to deny must be provided`));
+  });
 });
 
 describe('HeaderBehavior', () => {
@@ -182,4 +193,15 @@ describe('HeaderBehavior', () => {
       expect(() => { OriginRequestHeaderBehavior.all('X-MyCustomHeader'); }).toThrow(errorMessage);
     });
   });
+
+  test('denyList()', () => {
+    const headers = OriginRequestHeaderBehavior.denyList('SESSION_ID', 'secrets');
+
+    expect(headers.behavior).toEqual('allExcept');
+    expect(headers.headers).toEqual(['SESSION_ID', 'secrets']);
+  });
+
+  test('denyList() throws if list is empty', () => {
+    expect(() => OriginRequestHeaderBehavior.denyList()).toThrow(/At least one header to deny must be provided/);
+  });
 });